$ show BitterSecurity/Decepticon
Decepticon is an autonomous AI-powered red team agent platform for offensive security engagements. It orchestrates multiple LLM-based agents (recon, exploit, AD, cloud, etc.) via LangGraph to execute complex, realistic attack chains against targets, with strict Rules of Engagement (RoE) enforcement, sandboxed execution, and human-in-the-loop approval. The system provides a web dashboard (Next.js), CLI (Ink), and MCP server for control and monitoring, and includes a plugin system for extensibility. It also features comprehensive benchmark frameworks for evaluating agent performance on security challenges. The architecture is a multi-service Docker Compose deployment with Python backend services, a Go launcher, Neo4j knowledge graph, and high isolation between management and sandbox networks. This is primarily a software application (automated red team orchestrator) with strong data/research elements such as knowledge graph persistence, benchmarking pipelines, and telemetry collection. The codebase demonstrates high craftsmanship with protocol-based plugin contracts, a well-structured middleware stack, and thorough testing, though the polyglot nature and dual client maintenance add complexity.
The LLM identified 5 files worth highlighting for reuse:
Sandbox kernel module providing a reusable abstraction for managing shell sessions via tmux with background job tracking, stale-poll detection, and terminal noise sanitization. The TmuxSessionManager handles session lifecycle, command execution, and output capture using PS1 markers, while BackgroundJobTracker monitors long-running processes and detects completion via timeout and token patterns. This is a well-isolated module that could be extracted into any CLI tool needing managed shell interaction.
A Redactor class that replaces sensitive data (IP addresses, domains, email addresses, credential patterns, hostnames) with stable, deterministic placeholders while preserving structure. Uses regex patterns and callback functions for replacement, with a `replace_in_text()` method that also handles edge cases like bare hostnames. Demonstrates a well-crafted approach to data sanitization that is domain-agnostic and could be reused in any telemetry or logging pipeline.
A plug-in registry system with collision detection, role-based loading, safety checks, and skill source registration. The PluginRegistry class uses entry points for discovery, detects name conflicts and role mismatches during registration, and provides a `safe_load_all()` method. This is a generic plugin loading pattern that could be reused in other Python applications needing a safe, extensible plugin architecture.
Egress middleware that compiles a set of allowed egress targets (atored in RoE goals) into nftables and DNS allowlist rules. It determines the required protocols and ports from tool usage, generates appropriate iptables/nft chains with per-port accept rules, and can operate in audit/warn/enforce modes. This is a specialised but well-isolated component for programmatic network policy generation from high-level goals.
A SARIF (Static Analysis Results Interchange Format) report generator that produces standard-compliant JSON output with enhanced features: deduplication by scanner-rule-file-line, stable rule IDs and fingerprints, and CI severity gates (exit code based on findings). The module uses a clean data structure approach with `SarifReport` builder, making it reusable in any security tool that needs to output SARIF for integration with GitHub Code Scanning or DefectDojo.